SQL injection is yet another common vulnerability that is the result of lax input validation. Unlike cross-site scripting vulnerabilities that are ultimately directed at your site’s visitors, SQL injection is an attack on the site itself—in particular its database. The goal of SQL injection is to insert arbitrary data, most often a database query, into a string that’s eventually executed by the database. The insidious query may attempt any number of actions, from retrieving alternate data, to modifying or removing information from the database.

MagicTree is a penetration tester productivity tool. It is designed to allow easy and straightforward data consolidation, querying, external command execution and report generation. In case you wonder, "Tree" is because all the data is stored in a tree structure, and "Magic" is because it is designed to magically do the most cumbersome and boring part of penetration testing - data management and reporting.

MagicTree stores data in a tree structure. This is a natural way for representing the information that is gathered during a network test: a host has ports, which have services, applications, vulnerabilities, etc. The tree like structure is also flexible in terms of adding new information without disturbing the existing data structure: if you at some point decide that you need the MAC address of the host, you just add another child node to the host node.

Frox is a transparent FTP proxy that runs under Linux and *BSD. It should also work on other UNIX OSes that use ipfilter.

Frox Features:
* active - passive mode conversion for data connections.
* It supports caching of FTP downloads, either through a local cache, or by redirecting connections through another proxy such as squid.
* Downloads may be transparently scanned for viruses (through an external scanner).
* Optional non-transparent proxy support by logging in with user@host:port.
* Options to bind to a specific interface, chroot, and drop priveleges for security.
* Written with security in mind, default setup runs as a non-root user in a chroot jail.

Wine is an Open Source implementation of the Windows API on top of X and Unix. Wine provides both a development toolkit for porting Windows sources to Unix and a program loader, allowing many unmodified Windows binaries to run on x86-based Unixes.

Install the latest version of wine:
Ubuntu and Ubuntu derivatives (such as Kubuntu) obtain software from packages which are stored in repositories. Ubuntu's default repository includes Wine, however if you want to stay up to date with the latest Wine package you can use WineHQ's by following these instructions, open up the terminal (Applications > Accessories > Terminal) and type following command to install latest version of wine

The kernel is a piece of software that, roughly speaking, provides a layer between the hardware and the application programs running on a computer. In a strict, computer-science sense, the term 'Linux' refers only to the kernel - the software that Linus Torvalds wrote in the early 90s.

All the other pieces you find in a Linux distribution - the Bash shell, the KDE window manager, web browsers, the X server, Tux Racer and everything else - are just applications that happen to run on Linux and are emphatically not part of the operating system itself.

Backing up data can be difficult, especially when you only want to copy files that changed since the last backup. It can be even more troublesome when you have to remember to start the process manually,or you have to delete old backups to make room for new ones. Because of these difficulties, some people decide not to back up data at all, and feel the pain when they accidentally delete the wrong file or their system crashes. TimeVault is a backup utility for Ubuntu that addresses these problems.

TimeVault is an UI application that performs a function similar to Apple's TimeMachine. It makes automated snapshots of (selected parts of) the file system. You can roll back to a previous version of a file or directory, or just view it the way it was when the snapshot was taken. Snapshots are protected from accidental deletion or modification since they are read-only by default. The super-user can delete intermediate snapshots to save space, but files and directories that existed before or after the deletion will still be accessible

PhpSecInfo provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement. It is not a replacement for secure development techniques, and does not do any kind of code or app auditing, but can be a useful tool in a multilayered security approach.

* It is not a replacement for secure coding practices
* It does not audit PHP code
* It is not comprehensive test for either your hosting environment or your web application
* It is not the "final word." PHPSecInfo identifies *potential* problems and offers suggestions for improvement.

GreenSQL is an Open Source database firewall used to protect databases from SQL injection attacks. GreenSQL works as a proxy and has built in support for MySQL and PostgreSQL. The logic is based on evaluation of SQL commands using a risk scoring matrix as well as blocking known db administrative commands (DROP, CREATE, etc).

GreenSQL works as a reverse proxy for MySQL connections. This means, that instead of connecting TO THE MySQL server, your applications will connect to the GreenSQL server. GreenSQL will analyze SQL queries and then, if they're safe, will forward them to the back-end MySQL server.

Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.

Keep in mind that all types of security testing can be disruptive. Although the skipfish scanner is designed not to carry out malicious attacks, it may accidentally interfere with the operations of the site. You must accept the risk, and plan accordingly. Run the scanner against test instances where feasible, and be prepared to deal with the consequences if things go wrong.

Use skipfish only against services you own, or have a permission to test.

smem is a tool that can give numerous reports on memory usage on Linux systems. Unlike existing tools, smem can report proportional set size (PSS), which is a more meaningful representation of the amount of memory used by libraries and applications in a virtual memory system.

Because large portions of physical memory are typically shared among multiple applications, the standard measure of memory usage known as resident set size (RSS) will significantly overestimate memory usage. PSS instead measures each application's "fair share" of each shared area to give a realistic measure.